GHSA-4whq-r978-2x68

Source

https://github.com/advisories/GHSA-4whq-r978-2x68

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-4whq-r978-2x68/GHSA-4whq-r978-2x68.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4whq-r978-2x68

Published

2021-05-04T17:43:52Z

Modified

2021-10-08T21:20:43Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Arbitrary code execution in ExifTool

Details

Impact

Arbitrary code execution can occur when running exiftool against files with hostile metadata payloads.

Patches

ExifTool has already been patched in version 12.24. exiftool-vendored, which vendors ExifTool, includes this patch in v14.3.0.

Workarounds

No.

References

https://twitter.com/wcbowling/status/1385803927321415687 https://nvd.nist.gov/vuln/detail/CVE-2021-22204

For more information

If you have any questions or comments about this advisory: * Open an issue in exiftool-vendored

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-74"
    ],
    "nvd_published_at": null,
    "github_reviewed_at": "2021-05-04T17:33:25Z",
    "severity": "HIGH"
}

References

Affected packages

npm / exiftool-vendored

Package

Name: exiftool-vendored; View open source insights on deps.dev
Purl: pkg:npm/exiftool-vendored

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

14.3.0